cribl-control-plane 0.4.0b23__py3-none-any.whl → 0.5.0b3__py3-none-any.whl

cribl_control_plane/models/functionconfschemachain.py

@@ -0,0 +1,16 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from typing import Optional
+from typing_extensions import NotRequired, TypedDict
+
+
+class FunctionConfSchemaChainTypedDict(TypedDict):
+    processor: NotRequired[str]
+    r"""The data processor (Pack/Pipeline) to send events through"""
+
+
+class FunctionConfSchemaChain(BaseModel):
+    processor: Optional[str] = None
+    r"""The data processor (Pack/Pipeline) to send events through"""

cribl_control_plane/models/functionconfschemaclone.py

@@ -0,0 +1,16 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from typing import Dict, List, Optional
+from typing_extensions import NotRequired, TypedDict
+
+
+class FunctionConfSchemaCloneTypedDict(TypedDict):
+    clones: NotRequired[List[Dict[str, str]]]
+    r"""Create clones with the following fields set"""
+
+
+class FunctionConfSchemaClone(BaseModel):
+    clones: Optional[List[Dict[str, str]]] = None
+    r"""Create clones with the following fields set"""

cribl_control_plane/models/functionconfschemacode.py

@@ -0,0 +1,38 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaCodeTypedDict(TypedDict):
+    code: NotRequired[str]
+    r"""Caution: This Function will be evaluated in an unprotected context. This means that you will be able to execute almost any JavaScript code."""
+    max_num_of_iterations: NotRequired[float]
+    r"""The maximum number of allowed iterations within this Function. Defaults to 5,000."""
+    active_log_sample_rate: NotRequired[float]
+    r"""Rate at which this Function logs errors. For example, a value of 1 (the default) logs every error, a value of 10 logs every tenth error, and so on."""
+    use_unique_log_channel: NotRequired[bool]
+    r"""Logs from this Function will be sent to a unique channel in the form `func:code:${pipelineName}:${functionIndex}`. Disable to use the generic `func:code` log channel instead."""
+
+
+class FunctionConfSchemaCode(BaseModel):
+    code: Optional[str] = None
+    r"""Caution: This Function will be evaluated in an unprotected context. This means that you will be able to execute almost any JavaScript code."""
+
+    max_num_of_iterations: Annotated[
+        Optional[float], pydantic.Field(alias="maxNumOfIterations")
+    ] = 5000
+    r"""The maximum number of allowed iterations within this Function. Defaults to 5,000."""
+
+    active_log_sample_rate: Annotated[
+        Optional[float], pydantic.Field(alias="activeLogSampleRate")
+    ] = 1
+    r"""Rate at which this Function logs errors. For example, a value of 1 (the default) logs every error, a value of 10 logs every tenth error, and so on."""
+
+    use_unique_log_channel: Annotated[
+        Optional[bool], pydantic.Field(alias="useUniqueLogChannel")
+    ] = True
+    r"""Logs from this Function will be sent to a unique channel in the form `func:code:${pipelineName}:${functionIndex}`. Disable to use the generic `func:code` log channel instead."""

cribl_control_plane/models/functionconfschemacomment.py

@@ -0,0 +1,16 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from typing import Optional
+from typing_extensions import NotRequired, TypedDict
+
+
+class FunctionConfSchemaCommentTypedDict(TypedDict):
+    comment: NotRequired[str]
+    r"""Optional, short description of this Function's purpose in the Pipeline"""
+
+
+class FunctionConfSchemaComment(BaseModel):
+    comment: Optional[str] = None
+    r"""Optional, short description of this Function's purpose in the Pipeline"""

cribl_control_plane/models/functionconfschemadistinct.py

@@ -0,0 +1,41 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaDistinctTypedDict(TypedDict):
+    group_by: NotRequired[List[str]]
+    r"""Defines the properties that are concatenated to produce distinct key"""
+    max_combinations: NotRequired[float]
+    r"""maximum number of tracked combinations"""
+    max_depth: NotRequired[float]
+    r"""maximum number of groupBy properties"""
+    is_federated: NotRequired[bool]
+    r"""indicator that the operator runs on a federated executor"""
+    suppress_previews: NotRequired[bool]
+    r"""Toggle this on to suppress generating previews of intermediate results"""
+
+
+class FunctionConfSchemaDistinct(BaseModel):
+    group_by: Annotated[Optional[List[str]], pydantic.Field(alias="groupBy")] = None
+    r"""Defines the properties that are concatenated to produce distinct key"""
+
+    max_combinations: Annotated[
+        Optional[float], pydantic.Field(alias="maxCombinations")
+    ] = 10000
+    r"""maximum number of tracked combinations"""
+
+    max_depth: Annotated[Optional[float], pydantic.Field(alias="maxDepth")] = 15
+    r"""maximum number of groupBy properties"""
+
+    is_federated: Annotated[Optional[bool], pydantic.Field(alias="isFederated")] = False
+    r"""indicator that the operator runs on a federated executor"""
+
+    suppress_previews: Annotated[
+        Optional[bool], pydantic.Field(alias="suppressPreviews")
+    ] = None
+    r"""Toggle this on to suppress generating previews of intermediate results"""

cribl_control_plane/models/functionconfschemadnslookup.py

@@ -0,0 +1,193 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane import models, utils
+from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
+from enum import Enum
+import pydantic
+from pydantic import ConfigDict, field_serializer
+from pydantic.functional_validators import PlainValidator
+from typing import Any, Dict, List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class ResourceRecordType(str, Enum, metaclass=utils.OpenEnumMeta):
+    r"""The DNS record type (RR) to return. Defaults to 'A'."""
+
+    # A
+    A = "A"
+    # AAAA
+    AAAA = "AAAA"
+    # ANY
+    ANY = "ANY"
+    # CNAME
+    CNAME = "CNAME"
+    # MX
+    MX = "MX"
+    # NAPTR
+    NAPTR = "NAPTR"
+    # NS
+    NS = "NS"
+    # PTR
+    PTR = "PTR"
+    # SOA
+    SOA = "SOA"
+    # SRV
+    SRV = "SRV"
+    # TXT
+    TXT = "TXT"
+
+
+class DNSLookupFieldTypedDict(TypedDict):
+    in_field_name: NotRequired[str]
+    resource_record_type: NotRequired[ResourceRecordType]
+    r"""The DNS record type (RR) to return. Defaults to 'A'."""
+    out_field_name: NotRequired[str]
+    r"""Name of field to add lookup results to. Leave blank to overwrite the lookup field."""
+
+
+class DNSLookupField(BaseModel):
+    in_field_name: Annotated[Optional[str], pydantic.Field(alias="inFieldName")] = None
+
+    resource_record_type: Annotated[
+        Annotated[
+            Optional[ResourceRecordType], PlainValidator(validate_open_enum(False))
+        ],
+        pydantic.Field(alias="resourceRecordType"),
+    ] = ResourceRecordType.A
+    r"""The DNS record type (RR) to return. Defaults to 'A'."""
+
+    out_field_name: Annotated[Optional[str], pydantic.Field(alias="outFieldName")] = (
+        None
+    )
+    r"""Name of field to add lookup results to. Leave blank to overwrite the lookup field."""
+
+    @field_serializer("resource_record_type")
+    def serialize_resource_record_type(self, value):
+        if isinstance(value, str):
+            try:
+                return models.ResourceRecordType(value)
+            except ValueError:
+                return value
+        return value
+
+
+class ReverseLookupFieldTypedDict(TypedDict):
+    in_field_name: NotRequired[str]
+    r"""Name of the field containing the IP to look up. If the field value is not in IPv4 or IPv6 format, the lookup is skipped."""
+    out_field_name: NotRequired[str]
+    r"""Name of field to add the resolved domain to. Leave blank to overwrite the lookup field."""
+
+
+class ReverseLookupField(BaseModel):
+    in_field_name: Annotated[Optional[str], pydantic.Field(alias="inFieldName")] = None
+    r"""Name of the field containing the IP to look up. If the field value is not in IPv4 or IPv6 format, the lookup is skipped."""
+
+    out_field_name: Annotated[Optional[str], pydantic.Field(alias="outFieldName")] = (
+        None
+    )
+    r"""Name of field to add the resolved domain to. Leave blank to overwrite the lookup field."""
+
+
+class LogLevelForFailedLookups(str, Enum, metaclass=utils.OpenEnumMeta):
+    # silly
+    SILLY = "silly"
+    # debug
+    DEBUG = "debug"
+    # info
+    INFO = "info"
+    # warn
+    WARN = "warn"
+    # error
+    ERROR = "error"
+
+
+class FunctionConfSchemaDNSLookupTypedDict(TypedDict):
+    dns_lookup_fields: NotRequired[List[DNSLookupFieldTypedDict]]
+    r"""List of field names on which to perform DNS lookup"""
+    reverse_lookup_fields: NotRequired[List[ReverseLookupFieldTypedDict]]
+    r"""List of field names on which to perform reverse DNS lookup"""
+    dns_servers: NotRequired[List[str]]
+    r"""IPs, in RFC 5952 format, of the DNS servers to use for resolution. Examples: IPv4 1.1.1.1, 4.2.2.2:53, or IPv6 [2001:4860:4860::8888], [2001:4860:4860::8888]:1053. If not specified, system's DNS will be used."""
+    cache_ttl: NotRequired[float]
+    r"""How frequently to expire and refetch DNS cache. Use 0 to disable."""
+    max_cache_size: NotRequired[float]
+    r"""The maximum number of DNS resolutions to be cached locally. Leave at default unless you understand the implications of changing."""
+    use_resolv_conf: NotRequired[bool]
+    r"""Attempt to resolve DNS short names using the search or domain directive from /etc/resolv.conf"""
+    lookup_fallback: NotRequired[bool]
+    r"""If unable to resolve a DNS short name, make a DNS.lookup() call to resolve it. Caution: This might degrade performance in unrelated areas of @{product}."""
+    domain_overrides: NotRequired[List[str]]
+    r"""Specify fallback values for the DNS resolver to use when it cannot resolve a DNS short name"""
+    lookup_fail_log_level: NotRequired[LogLevelForFailedLookups]
+
+
+class FunctionConfSchemaDNSLookup(BaseModel):
+    model_config = ConfigDict(
+        populate_by_name=True, arbitrary_types_allowed=True, extra="allow"
+    )
+    __pydantic_extra__: Dict[str, Any] = pydantic.Field(init=False)
+
+    dns_lookup_fields: Annotated[
+        Optional[List[DNSLookupField]], pydantic.Field(alias="dnsLookupFields")
+    ] = None
+    r"""List of field names on which to perform DNS lookup"""
+
+    reverse_lookup_fields: Annotated[
+        Optional[List[ReverseLookupField]], pydantic.Field(alias="reverseLookupFields")
+    ] = None
+    r"""List of field names on which to perform reverse DNS lookup"""
+
+    dns_servers: Annotated[Optional[List[str]], pydantic.Field(alias="dnsServers")] = (
+        None
+    )
+    r"""IPs, in RFC 5952 format, of the DNS servers to use for resolution. Examples: IPv4 1.1.1.1, 4.2.2.2:53, or IPv6 [2001:4860:4860::8888], [2001:4860:4860::8888]:1053. If not specified, system's DNS will be used."""
+
+    cache_ttl: Annotated[Optional[float], pydantic.Field(alias="cacheTTL")] = 30
+    r"""How frequently to expire and refetch DNS cache. Use 0 to disable."""
+
+    max_cache_size: Annotated[Optional[float], pydantic.Field(alias="maxCacheSize")] = (
+        5000
+    )
+    r"""The maximum number of DNS resolutions to be cached locally. Leave at default unless you understand the implications of changing."""
+
+    use_resolv_conf: Annotated[
+        Optional[bool], pydantic.Field(alias="useResolvConf")
+    ] = False
+    r"""Attempt to resolve DNS short names using the search or domain directive from /etc/resolv.conf"""
+
+    lookup_fallback: Annotated[
+        Optional[bool], pydantic.Field(alias="lookupFallback")
+    ] = False
+    r"""If unable to resolve a DNS short name, make a DNS.lookup() call to resolve it. Caution: This might degrade performance in unrelated areas of @{product}."""
+
+    domain_overrides: Annotated[
+        Optional[List[str]], pydantic.Field(alias="domainOverrides")
+    ] = None
+    r"""Specify fallback values for the DNS resolver to use when it cannot resolve a DNS short name"""
+
+    lookup_fail_log_level: Annotated[
+        Annotated[
+            Optional[LogLevelForFailedLookups],
+            PlainValidator(validate_open_enum(False)),
+        ],
+        pydantic.Field(alias="lookupFailLogLevel"),
+    ] = LogLevelForFailedLookups.ERROR
+
+    @property
+    def additional_properties(self):
+        return self.__pydantic_extra__
+
+    @additional_properties.setter
+    def additional_properties(self, value):
+        self.__pydantic_extra__ = value  # pyright: ignore[reportIncompatibleVariableOverride]
+
+    @field_serializer("lookup_fail_log_level")
+    def serialize_lookup_fail_log_level(self, value):
+        if isinstance(value, str):
+            try:
+                return models.LogLevelForFailedLookups(value)
+            except ValueError:
+                return value
+        return value

cribl_control_plane/models/functionconfschemadrop.py

@@ -0,0 +1,13 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from typing_extensions import TypedDict
+
+
+class FunctionConfSchemaDropTypedDict(TypedDict):
+    pass
+
+
+class FunctionConfSchemaDrop(BaseModel):
+    pass

cribl_control_plane/models/functionconfschemadropdimensions.py

@@ -0,0 +1,31 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaDropDimensionsTypedDict(TypedDict):
+    time_window: NotRequired[str]
+    r"""The time span of the tumbling window for aggregating events. Must be a valid time string (such as 10s)."""
+    drop_dimensions: NotRequired[List[str]]
+    r"""One or more dimensions to be dropped. Supports wildcard expressions. Warning: Using wildcard '*' causes all dimensions in the event to be dropped."""
+    flush_on_input_close: NotRequired[bool]
+    r"""Flush aggregations when an input stream is closed. If disabled, aggregations are flushed based on Time Window Settings instead."""
+
+
+class FunctionConfSchemaDropDimensions(BaseModel):
+    time_window: Annotated[Optional[str], pydantic.Field(alias="timeWindow")] = "10s"
+    r"""The time span of the tumbling window for aggregating events. Must be a valid time string (such as 10s)."""
+
+    drop_dimensions: Annotated[
+        Optional[List[str]], pydantic.Field(alias="dropDimensions")
+    ] = None
+    r"""One or more dimensions to be dropped. Supports wildcard expressions. Warning: Using wildcard '*' causes all dimensions in the event to be dropped."""
+
+    flush_on_input_close: Annotated[
+        Optional[bool], pydantic.Field(alias="flushOnInputClose")
+    ] = True
+    r"""Flush aggregations when an input stream is closed. If disabled, aggregations are flushed based on Time Window Settings instead."""

cribl_control_plane/models/functionconfschemadynamicsampling.py

@@ -0,0 +1,67 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane import models, utils
+from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
+from enum import Enum
+import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaDynamicSamplingSampleMode(
+    str, Enum, metaclass=utils.OpenEnumMeta
+):
+    r"""Defines how sample rate will be derived: log(previousPeriodCount) or sqrt(previousPeriodCount)"""
+
+    # Logarithmic
+    LOG = "log"
+    # Square Root
+    SQRT = "sqrt"
+
+
+class FunctionConfSchemaDynamicSamplingTypedDict(TypedDict):
+    mode: NotRequired[FunctionConfSchemaDynamicSamplingSampleMode]
+    r"""Defines how sample rate will be derived: log(previousPeriodCount) or sqrt(previousPeriodCount)"""
+    key_expr: NotRequired[str]
+    r"""Expression used to derive sample group key. Example:`${domain}:${status}`. Each sample group will have its own derived sampling rate based on volume. Defaults to `${host}`."""
+    sample_period: NotRequired[float]
+    r"""How often (in seconds) sample rates will be adjusted"""
+    min_events: NotRequired[float]
+    r"""Minimum number of events that must be received in previous sample period for sampling mode to be applied to current period. If the number of events received for a sample group is less than this minimum, a sample rate of 1:1 is used."""
+    max_sample_rate: NotRequired[float]
+    r"""Maximum sampling rate. If computed sampling rate is above this value, it will be limited to this value."""
+
+
+class FunctionConfSchemaDynamicSampling(BaseModel):
+    mode: Annotated[
+        Optional[FunctionConfSchemaDynamicSamplingSampleMode],
+        PlainValidator(validate_open_enum(False)),
+    ] = FunctionConfSchemaDynamicSamplingSampleMode.LOG
+    r"""Defines how sample rate will be derived: log(previousPeriodCount) or sqrt(previousPeriodCount)"""
+
+    key_expr: Annotated[Optional[str], pydantic.Field(alias="keyExpr")] = "`${host}`"
+    r"""Expression used to derive sample group key. Example:`${domain}:${status}`. Each sample group will have its own derived sampling rate based on volume. Defaults to `${host}`."""
+
+    sample_period: Annotated[Optional[float], pydantic.Field(alias="samplePeriod")] = 30
+    r"""How often (in seconds) sample rates will be adjusted"""
+
+    min_events: Annotated[Optional[float], pydantic.Field(alias="minEvents")] = 30
+    r"""Minimum number of events that must be received in previous sample period for sampling mode to be applied to current period. If the number of events received for a sample group is less than this minimum, a sample rate of 1:1 is used."""
+
+    max_sample_rate: Annotated[
+        Optional[float], pydantic.Field(alias="maxSampleRate")
+    ] = 100
+    r"""Maximum sampling rate. If computed sampling rate is above this value, it will be limited to this value."""
+
+    @field_serializer("mode")
+    def serialize_mode(self, value):
+        if isinstance(value, str):
+            try:
+                return models.FunctionConfSchemaDynamicSamplingSampleMode(value)
+            except ValueError:
+                return value
+        return value

cribl_control_plane/models/functionconfschemaeval.py

@@ -0,0 +1,44 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from typing import List, Optional
+from typing_extensions import NotRequired, TypedDict
+
+
+class FunctionConfSchemaEvalAddTypedDict(TypedDict):
+    value: str
+    r"""JavaScript expression to compute the value (can be constant)"""
+    name: NotRequired[str]
+    disabled: NotRequired[bool]
+    r"""Set to No to disable the evaluation of an individual expression"""
+
+
+class FunctionConfSchemaEvalAdd(BaseModel):
+    value: str
+    r"""JavaScript expression to compute the value (can be constant)"""
+
+    name: Optional[str] = None
+
+    disabled: Optional[bool] = False
+    r"""Set to No to disable the evaluation of an individual expression"""
+
+
+class FunctionConfSchemaEvalTypedDict(TypedDict):
+    add: NotRequired[List[FunctionConfSchemaEvalAddTypedDict]]
+    r"""Set of key-value pairs to evaluate and add/set"""
+    keep: NotRequired[List[str]]
+    r"""List of fields to keep. Supports * wildcards. Takes precedence over 'Remove fields'."""
+    remove: NotRequired[List[str]]
+    r"""List of fields to remove. Supports * wildcards. Fields that match 'Keep fields' will not be removed. Enclose field names containing special characters in single or double quotes."""
+
+
+class FunctionConfSchemaEval(BaseModel):
+    add: Optional[List[FunctionConfSchemaEvalAdd]] = None
+    r"""Set of key-value pairs to evaluate and add/set"""
+
+    keep: Optional[List[str]] = None
+    r"""List of fields to keep. Supports * wildcards. Takes precedence over 'Remove fields'."""
+
+    remove: Optional[List[str]] = None
+    r"""List of fields to remove. Supports * wildcards. Fields that match 'Keep fields' will not be removed. Enclose field names containing special characters in single or double quotes."""

cribl_control_plane/models/functionconfschemaeventbreaker.py

@@ -0,0 +1,51 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane import models, utils
+from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
+from enum import Enum
+import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaEventBreakerExistingOrNew(
+    str, Enum, metaclass=utils.OpenEnumMeta
+):
+    # Use Existing
+    EXISTING = "existing"
+    # Create New
+    NEW = "new"
+
+
+class FunctionConfSchemaEventBreakerTypedDict(TypedDict):
+    existing_or_new: NotRequired[FunctionConfSchemaEventBreakerExistingOrNew]
+    should_mark_cribl_breaker: NotRequired[bool]
+    r"""Add this Function name to the cribl_breaker field"""
+
+
+class FunctionConfSchemaEventBreaker(BaseModel):
+    existing_or_new: Annotated[
+        Annotated[
+            Optional[FunctionConfSchemaEventBreakerExistingOrNew],
+            PlainValidator(validate_open_enum(False)),
+        ],
+        pydantic.Field(alias="existingOrNew"),
+    ] = FunctionConfSchemaEventBreakerExistingOrNew.EXISTING
+
+    should_mark_cribl_breaker: Annotated[
+        Optional[bool], pydantic.Field(alias="shouldMarkCriblBreaker")
+    ] = True
+    r"""Add this Function name to the cribl_breaker field"""
+
+    @field_serializer("existing_or_new")
+    def serialize_existing_or_new(self, value):
+        if isinstance(value, str):
+            try:
+                return models.FunctionConfSchemaEventBreakerExistingOrNew(value)
+            except ValueError:
+                return value
+        return value

cribl_control_plane/models/functionconfschemaeventstats.py

@@ -0,0 +1,34 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaEventstatsTypedDict(TypedDict):
+    aggregations: NotRequired[List[str]]
+    r"""Aggregate function(s) to perform on events. E.g., sum(bytes).where(action=='REJECT').as(TotalBytes)"""
+    group_bys: NotRequired[List[str]]
+    r"""Fields to group aggregates by, supports wildcard expressions."""
+    max_events: NotRequired[float]
+    r"""Specifies how many events are at max kept in memory to be enriched with aggregations"""
+    flush_on_input_close: NotRequired[bool]
+    r"""Determines if aggregations should flush when an input stream is closed. If disabled, time window settings will control flush behavior."""
+
+
+class FunctionConfSchemaEventstats(BaseModel):
+    aggregations: Optional[List[str]] = None
+    r"""Aggregate function(s) to perform on events. E.g., sum(bytes).where(action=='REJECT').as(TotalBytes)"""
+
+    group_bys: Annotated[Optional[List[str]], pydantic.Field(alias="groupBys")] = None
+    r"""Fields to group aggregates by, supports wildcard expressions."""
+
+    max_events: Annotated[Optional[float], pydantic.Field(alias="maxEvents")] = 50000
+    r"""Specifies how many events are at max kept in memory to be enriched with aggregations"""
+
+    flush_on_input_close: Annotated[
+        Optional[bool], pydantic.Field(alias="flushOnInputClose")
+    ] = False
+    r"""Determines if aggregations should flush when an input stream is closed. If disabled, time window settings will control flush behavior."""

cribl_control_plane/models/functionconfschemaexternaldata.py

@@ -0,0 +1,13 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from typing_extensions import TypedDict
+
+
+class FunctionConfSchemaExternaldataTypedDict(TypedDict):
+    pass
+
+
+class FunctionConfSchemaExternaldata(BaseModel):
+    pass

cribl_control_plane/models/functionconfschemaflatten.py

@@ -0,0 +1,31 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from typing import List, Optional
+from typing_extensions import NotRequired, TypedDict
+
+
+class FunctionConfSchemaFlattenTypedDict(TypedDict):
+    fields: NotRequired[List[str]]
+    r"""List of top-level fields to include for flattening. Supports * wildcards, except when used on internal fields. Defaults to empty array, which means all fields."""
+    prefix: NotRequired[str]
+    r"""Prefix string for flattened field names. Defaults to empty."""
+    depth: NotRequired[float]
+    r"""Number representing the nested levels to consider for flattening. Defaults to 5. Minimum should be 1."""
+    delimiter: NotRequired[str]
+    r"""Delimiter to be used for flattening. Defaults to underscore."""
+
+
+class FunctionConfSchemaFlatten(BaseModel):
+    fields: Optional[List[str]] = None
+    r"""List of top-level fields to include for flattening. Supports * wildcards, except when used on internal fields. Defaults to empty array, which means all fields."""
+
+    prefix: Optional[str] = ""
+    r"""Prefix string for flattened field names. Defaults to empty."""
+
+    depth: Optional[float] = 5
+    r"""Number representing the nested levels to consider for flattening. Defaults to 5. Minimum should be 1."""
+
+    delimiter: Optional[str] = "_"
+    r"""Delimiter to be used for flattening. Defaults to underscore."""

cribl_control_plane/models/functionconfschemafoldkeys.py

@@ -0,0 +1,31 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionConfSchemaFoldkeysTypedDict(TypedDict):
+    delete_original: NotRequired[bool]
+    r"""When enabled (default), only the folded keys are kept. When disabled, the original entries are retained alongside the folded keys."""
+    separator: NotRequired[str]
+    r"""Character or string used to separate key levels to be folded. Defaults to the dot (.) character."""
+    selection_reg_exp: NotRequired[str]
+    r"""Optional regular expression to select a subset of the keys to fold."""
+
+
+class FunctionConfSchemaFoldkeys(BaseModel):
+    delete_original: Annotated[
+        Optional[bool], pydantic.Field(alias="deleteOriginal")
+    ] = True
+    r"""When enabled (default), only the folded keys are kept. When disabled, the original entries are retained alongside the folded keys."""
+
+    separator: Optional[str] = "."
+    r"""Character or string used to separate key levels to be folded. Defaults to the dot (.) character."""
+
+    selection_reg_exp: Annotated[
+        Optional[str], pydantic.Field(alias="selectionRegExp")
+    ] = None
+    r"""Optional regular expression to select a subset of the keys to fold."""